On Thu, 25 Feb 2016, Dennis Gilmore wrote: > No one has access to the private key. It lives on a server that has no > services running that listen for connections. There is a service that > runs > on > it that talks to the signing bridge. That brokers all requests. Users > with > access do not know the password to unlock the key. The signing server > manages > access. There is exactly two copies of the private key, one embeded in > encrypted storage on the signing server and a backup of the encrypted > storage > on the backup server. It has been designed to allow the granting and > revocation of access without the need for having a copy of the private > key. > > https://fedorahosted.org/sigul/ is the software we use > > Dennis Thank you for providing this valuable information about the handling of the private key that enables Fedora ISO signing. This information should be shared and highlighted as it is helping to create trust in the use of this key. As a personal request, would you be so kind as to confirm the fingerprint here (and maybe somewhere else), please. Thank you very much.

PS: if you had a long-term signing key it would be its fingerprint.

Thank you for providing this valuable information about the handling of the private key that enables Fedora ISO signing. This information should be shared and highlighted as it is helping to create trust in the use of this key.

As a personal request, would you be so kind as to confirm the fingerprint here (and maybe somewhere else), please. Thank you very much.

> What would be proper other places to confirm the fingerprint? The following criteria might be reasonable: - a place that has authority, that people might trust. - a place that is hard to impersonate, that has some protection against unauthorized use - a place that is visible to many people with a need to verify. - a place that is known for publishing cross-checked, reliable information

> What would be proper other places to confirm the fingerprint? The following criteria might be reasonable: - a place that has authority, that people might trust. - a place that is hard to impersonate, that has some protection against unauthorized use - a place that is visible to many people with a need to verify. - a place that is known for publishing cross-checked, reliable information Hope that helps to find such places.

On 7 March 2016 at 01:32, Ralf Senderek <fedora(a)senderek.ie&gt; wrote: >> What would be proper other places to confirm the fingerprint? > > The following criteria might be reasonable: > - a place that has authority, that people might trust. > - a place that is hard to impersonate, that has some protection > against unauthorized use > - a place that is visible to many people with a need to verify. > - a place that is known for publishing cross-checked, reliable information > > Hope that helps to find such places. Not really. Everything above is subjective. In the past, when I have looked for sites that meet such criteria no one agrees that the place meets such criteria. We put it in redhat.com and people who hate corporations or that Red Hat sponsors this project assume that if Red Hat were paid enough money they would change the data any time. We put it in archive.org and people wonder how we can tell it isn't impersonated by some other site or that someone else isn't changing it. We put it in lwn.net and people wonder how they will know where to find it or why we didn't choose reddit/slashdot/etc/etc. We get google to host it and people wonder all of the above.